<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>惜缘怀古的博客 - 欢迎你来到我的小世界</title><meta name="keywords" content="惜缘怀古，博客"><meta name="author" content="惜缘怀古"><meta name="copyright" content="惜缘怀古"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="唯有那份炫目，未曾忘却">
<meta property="og:type" content="website">
<meta property="og:title" content="惜缘怀古的博客">
<meta property="og:url" content="https://xiyuanhuaigu.gitee.io/page/4/index.html">
<meta property="og:site_name" content="惜缘怀古的博客">
<meta property="og:description" content="唯有那份炫目，未曾忘却">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://xiyuanhuaigu.gitee.io/img/2.jpg">
<meta property="article:author" content="惜缘怀古">
<meta property="article:tag" content="惜缘怀古，博客">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://xiyuanhuaigu.gitee.io/img/2.jpg"><link rel="shortcut icon" href="/img/favicon.png"><link rel="canonical" href="https://xiyuanhuaigu.gitee.io/page/4/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: undefined,
  translate: undefined,
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: undefined,
  source: {
    jQuery: 'https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js',
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/js/jquery.justifiedGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/css/justifiedGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isanchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: '惜缘怀古的博客',
  isPost: false,
  isHome: true,
  isHighlightShrink: false,
  isToc: false,
  postUpdate: '2024-01-18 10:16:30'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if (GLOBAL_CONFIG_SITE.isHome && /iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"></head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/img/2.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">66</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div></div><hr/></div></div><div class="page" id="body-wrap"><header class="full_page" id="page-header" style="background-image: url('https://gimg2.baidu.com/image_search/src=http%3A%2F%2Fi0.hdslb.com%2Fbfs%2Farticle%2F3213259c70268dc2a32c6666d7861bf65fa487a0.jpg&amp;refer=http%3A%2F%2Fi0.hdslb.com&amp;app=2002&amp;size=f9999,10000&amp;q=a80&amp;n=0&amp;g=0n&amp;fmt=jpeg?sec=1636166607&amp;t=a6f3b742174dda05e9c7222a32bc3b96')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">惜缘怀古的博客</a></span><div id="menus"><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="site-info"><h1 id="site-title">惜缘怀古的博客</h1></div><div id="scroll-down"><i class="fas fa-angle-down scroll-down-effects"></i></div></header><main class="layout" id="content-inner"><div class="recent-posts" id="recent-posts"><div class="recent-post-item"><div class="post_cover left"><a href="/2022/07/06/ctfshow-web%E5%85%A5%E9%97%A8-%E7%88%86%E7%A0%B4/" title="ctfshow web入门 爆破"><img class="post_bg" src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/241a389f507b0b2a6168d74f43c142d3419c8c6c_raw.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="ctfshow web入门 爆破"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/07/06/ctfshow-web%E5%85%A5%E9%97%A8-%E7%88%86%E7%A0%B4/" title="ctfshow web入门 爆破">ctfshow web入门 爆破</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-07-06T11:39:31.000Z" title="发表于 2022-07-06 19:39:31">2022-07-06</time></span></div><div class="content">web21我们随便输入并使用bs抓包得

通过对这串进行base64解码得此处就是我们输入的账号与密码，形式为：账号：密码
我们使用BS中的测试器模块





开始攻击

得到flag
web 22现在子域名无法爆破出来，直接查看hint得到flag
web 23分析源码，我们可以知道token首先被md5进行加密，而且它的第一位=第14位=第17位，（第一位+第十四位+第十七位）/第一位=第三十一位
1234567891011121314151617&lt;?phperror_reporting(0);include(&#x27;flag.php&#x27;);if(isset($_GET[&#x27;token&#x27;]))&#123;    $token = md5($_GET[&#x27;token&#x27;]);    if(substr($token, 1,1)===substr($token, 14,1) &amp;&amp; substr($token, 14,1) ===substr($token, 17,1))&#123;        if((intval ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/07/04/CTFshow-%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/" title="CTFshow-信息收集"><img class="post_bg" src="/img/ctfshowxinxishouji.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="CTFshow-信息收集"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/07/04/CTFshow-%E4%BF%A1%E6%81%AF%E6%94%B6%E9%9B%86/" title="CTFshow-信息收集">CTFshow-信息收集</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-07-04T07:38:50.000Z" title="发表于 2022-07-04 15:38:50">2022-07-04</time></span></div><div class="content">web 1直接查看源代码即可得到flag 
web2本题禁用了右键和f12,通过Ctrl+u或者在url前面添加view-source:也可获得flag
web3 响应头右键查看源代码 ，什么都没有发现，直接抓包，在响应包中发现flag
web4 robots.txt访问robots.txt发现/flagishere.txt。访问flagishere.txt得到flag.
web5 index.phps访问index.phps得到flag
phps文件就是php的源代码文件，通常用于提供给用户（访问者）查看php代码，因为用户无法直接通过Web浏览器看到php文件的内容，所以需要用phps文件代替。其实，只要不用php等已经在服务器中注册过的MIME类型为文件即可，但为了国际通用，所以才用了phps文件类型。
它的MIME类型为：text/html, application/x-httpd-php-source, application/x-httpd-php3-source。
web6 www.zip尝试一下常见的源码包名字www.zip，即可下载压缩包，在压缩包中发现flag,但提 ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2022/07/03/Meterpreter/" title="Meterpreter"><img class="post_bg" src="/img/meta.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Meterpreter"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/07/03/Meterpreter/" title="Meterpreter">Meterpreter</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-07-03T02:54:04.000Z" title="发表于 2022-07-03 10:54:04">2022-07-03</time></span></div><div class="content">
</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/07/01/Linux%E7%BC%96%E8%AF%91%E7%8E%AF%E5%A2%83%E9%85%8D%E7%BD%AE/" title="Linux编译环境配置"><img class="post_bg" src="/img/linuxbinyi.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Linux编译环境配置"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/07/01/Linux%E7%BC%96%E8%AF%91%E7%8E%AF%E5%A2%83%E9%85%8D%E7%BD%AE/" title="Linux编译环境配置">Linux编译环境配置</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-07-01T02:30:08.000Z" title="发表于 2022-07-01 10:30:08">2022-07-01</time></span></div><div class="content">Linux下的编译环境配置C/C++环境配置C编译环境的配置1apt-get install gcc

执行结束后我们可以查看版本
1gcc --version

使用1gcc --h

可以查看该命令的所有操作
接下来我们写一个HelloWorld.c并编译运行。
vim HelloWorld.c
#include&lt;stdio.h&gt;int main(void)
{printf(“Hello World!\n”);}
保存好后进行编译
gcc HelloWorld.c -o HelloWolrd
编译成功后运行
./HelloWorld
C++编译环境配置1apt-get install g++

查看版本
1g++ --version

使用
1g++ --h

查看该命令的所有操作
然后接下来我们用C++写一个HelloWorld.cpp
vim HelloWorld.cpp
#includeusing namespace std;int main(void){cout&lt;&lt;”Hello World!”&lt;&lt;endl;}
g++ HelloWorld ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2022/07/01/Vim%E6%8C%87%E4%BB%A4/" title="Vim指令"><img class="post_bg" src="/img/vimuser.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Vim指令"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/07/01/Vim%E6%8C%87%E4%BB%A4/" title="Vim指令">Vim指令</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-07-01T01:06:31.000Z" title="发表于 2022-07-01 09:06:31">2022-07-01</time></span></div><div class="content">Vim 的基本使用方法Vim快捷键练习神器—-VimTutorVimTutor是新手可以快速入门Vim的一个Vim内置应用，直接在Vim命令行下，敲Vimtutor，回车即可进入练习。
Vim的三种模式Vim可以分为三种模式，分别为：

命令行模式（Command mode）

插入模式（Insert mode）

底行模式（Lastline mode）
命令行模式

控制屏幕光标的移动，字符、字或行的删除，移动复制某区段及进入Insert mode下，或者到 last line mode。

插入模式

只有在Insert mode下，才可以做文字输入，按「ESC」键可回到命令行模式。

底行模式

将文件保存或退出vim，也可以设置编辑环境，如寻找字符串、列出行号……等。



Vim的基本操作
进入Vim
在系统光标提示符后，输入vim及文件名后，回车，进入Vim编辑画面。
特别注意，进入vim之后，是处于「命令行模式（command mode）」，要切换到「插入模式 （Insert mode）」才能够输入文字。

切换至插入模式（Insert mode）编辑文件在「命令行模式（ ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/05/19/netcat%E7%9A%84%E4%BD%BF%E7%94%A8/" title="netcat的使用"><img class="post_bg" src="/img/nc.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="netcat的使用"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/19/netcat%E7%9A%84%E4%BD%BF%E7%94%A8/" title="netcat的使用">netcat的使用</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-19T12:43:16.000Z" title="发表于 2022-05-19 20:43:16">2022-05-19</time></span></div><div class="content"></div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2022/05/18/Web-Services/" title="Web Services"><img class="post_bg" src="/img/WebServices.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Web Services"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/18/Web-Services/" title="Web Services">Web Services</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-18T11:03:41.000Z" title="发表于 2022-05-18 19:03:41">2022-05-18</time></span></div><div class="content">Web Services简介：​        Web Service是一个平台独立的，低耦合的，自包含的、基于可编程的web的应用程序，可使用开放的XML（标准通用标记语言下的一个子集）标准来描述、发布、发现、协调和配置这些应用程序，用于开发分布式的交互操作的应用程序。 [1] 
​        Web Service技术，  能使得运行在不同机器上的不同应用无须借助附加的、专门的第三方软件或硬件， 就可相互交换数据或集成。依据Web Service规范实施的应用之间， 无论它们所使用的语言、 平台或内部协议是什么， 都可以相互交换数据。Web Service是自描述、 自包含的可用网络模块，  可以执行具体的业务功能。Web Service也很容易部署， 因为它们基于一些常规的产业标准以及已有的一些技术，诸如标准通用标记语言下的子集XML、HTTP。Web Service减少了应用接口的花费。Web Service为整个企业甚至多个组织之间的业务流程的集成提供了一个通用机制。
支持：Web Service平台需要一套协议来实现分布式应用程序的创建。任何平台都有它的数据表示方法和类 ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/05/18/%E6%B5%85%E8%B0%88soap/" title="浅谈soap"><img class="post_bg" src="/img/soap.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="浅谈soap"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/18/%E6%B5%85%E8%B0%88soap/" title="浅谈soap">浅谈soap</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-18T09:30:40.000Z" title="发表于 2022-05-18 17:30:40">2022-05-18</time></span></div><div class="content">浅谈SOAP




</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2022/05/18/%E5%86%B0%E8%9D%8E/" title="冰蝎"><img class="post_bg" src="/img/bingxie.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="冰蝎"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/18/%E5%86%B0%E8%9D%8E/" title="冰蝎">冰蝎</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-18T07:47:28.000Z" title="发表于 2022-05-18 15:47:28">2022-05-18</time></span></div><div class="content">冰蝎介绍：Webshell管理工具，动态二进制加密网站客户端。流量动态加密，攻击特征安全设备（WAF、WebIDS）难以检测。
  冰蝎通信过程中使用AES（高级加密算法，对称加密，微信小程序使用此种方法）进行加密，Java和.NET默认支持AES，php中需要开启openssl扩展，在V2.0版本后，php环境方式根据服务端支持情况动态选择，使得冰蝎更强大，V3.0中使用预共享密钥，全程无明文交互，给waf、ids设备威胁狩猎带来挑战。
安装：在这附上网盘链接：
链接：https://pan.baidu.com/s/1UdIhDjupoWHXyRQJINjXhA提取码：pass
将文件解压后直接点击Behinder.jar文件即可直接运行。
注：运行环境需要java8及以上。
安装问题解决：打不开的原因：冰蝎beta7版本客户端不再内置javafx库，java11以后版本移除了JavaFX库，要运行冰蝎需要自己下载JavaFX库。
那就是缺了一块javafx，下载就可以了
下载链接：https://gluonhq.com/products/javafx/
选择适合的版本，比如我的是j ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/05/16/CRLF/" title="CRLF"><img class="post_bg" src="/img/crelf.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="CRLF"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/16/CRLF/" title="CRLF">CRLF</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-16T13:32:47.000Z" title="发表于 2022-05-16 21:32:47">2022-05-16</time></span></div><div class="content">CRLF简介：CRLF的意思
就是回车(CR, ASCII 13, \r) 换行(LF, ASCII 10, \n)。
换行在有的ASCII码表也用newline（简nl）来进行表示,这里的lf是line feed的概念，意思是一样的。
这两个ACSII字符不会在屏幕有任何输出，但在Windows中广泛使用来标识一行的结束。而在Linux/UNIX系统中只有换行符。
CRLF命令


代码
ASCII码
符号
概念



CR
13
\r
光标移到行首


LF
10
\n
光标垂直移到下行


CRLF

%0d%0a



注意:但是不同的操作系统行的结束符是不一样的,所以同一文件在不同操作系统中打开，内容格式可能会出现差异，这是行结束符不一致导致的。

Windows：使用CRLF表示行的结束
Linux/Unix：使用LF表示行的结束
MacOS：早期使用CR表示，现在好像也用LF表示行的结束

在HTTP规范中，行应该使用CRLF来结束。首部与主体由两个CRLF分隔，浏览器根据这两个CRLF来获取HTTP内容并显示。
CRLF注入就是说黑客能够将CRLF命令注入到系统中。它不 ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2022/05/16/sqlmap%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95/" title="sqlmap使用方法"><img class="post_bg" src="/img/sqlmap.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="sqlmap使用方法"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/16/sqlmap%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%95/" title="sqlmap使用方法">sqlmap使用方法</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-16T02:24:18.000Z" title="发表于 2022-05-16 10:24:18">2022-05-16</time></span></div><div class="content">Options（选项）-h：帮助文档
--version：查看sqlmap版本信息
-v:显示详细信息
   ·0：只显示python的错误和一些严重性的信息
   ·1：显示基本信息（默认）
   ·2：显示debug信息
   ·3：显示注入过程的payload
   ·4：显示http请求包
   ·5：显示http响应头
   ·6：显示http响应页面

Target（目标）-d：直接连接数据库（格式：‘mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME’）
-u：指定url扫描,但url必须存在查询参数. 例: xxx.php?id=1
l：后面跟一个log文件，判断log（日志）文件中所有记录是否存在注入点（用于多个url）
m：后面跟一个txt文件，判断txt文件中所有记录是否存在注入点（用于多个url）
-r:检查post请求是否存在注入（可以通过抓包工具抓取包，把请求保存在一个文档中，不限制文档后缀）。
Request（请求）

​      -‌-method：指定请求是提交的方法。如 –method=GET ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2022/05/13/CTFShow-web%E5%85%A5%E9%97%A8-PHP%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/" title="CTFShow web入门 PHP反序列化"><img class="post_bg" src="/img/ctfshowwbfxlh.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="CTFShow web入门 PHP反序列化"></a></div><div class="recent-post-info"><a class="article-title" href="/2022/05/13/CTFShow-web%E5%85%A5%E9%97%A8-PHP%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/" title="CTFShow web入门 PHP反序列化">CTFShow web入门 PHP反序列化</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2022-05-13T11:13:19.000Z" title="发表于 2022-05-13 19:13:19">2022-05-13</time></span></div><div class="content">web254查看一下源代码：            
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354&lt;?php/*# -*- coding: utf-8 -*-# @Author: h1xa# @Date:   2020-12-02 17:44:47# @Last Modified by:   h1xa# @Last Modified time: 2020-12-02 19:29:02# @email: h1xa@ctfer.com# @link: https://ctfer.com*/error_reporting(0);highlight_file(__FILE__);include(&#x27;flag.php&#x27;);class ctfShowUser&#123;    public $username=&#x27;xxxxxx&#x27;;    public $password=&#x27;xxxxxx&#x27 ...</div></div></div><nav id="pagination"><div class="pagination"><a class="extend prev" rel="prev" href="/page/3/#content-inner"><i class="fas fa-chevron-left fa-fw"></i></a><a class="page-number" href="/">1</a><span class="space">&hellip;</span><a class="page-number" href="/page/3/#content-inner">3</a><span class="page-number current">4</span><a class="page-number" href="/page/5/#content-inner">5</a><a class="page-number" href="/page/6/#content-inner">6</a><a class="extend next" rel="next" href="/page/5/#content-inner"><i class="fas fa-chevron-right fa-fw"></i></a></div></nav></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="/img/2.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">惜缘怀古</div><div class="author-info__description">唯有那份炫目，未曾忘却</div></div><div class="card-info-data is-center"><div class="card-info-data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">66</div></a></div><div class="card-info-data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">0</div></a></div><div class="card-info-data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div></div><a class="button--animated" id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/xxxxxx"><i class="fab fa-github"></i><span>Follow Me</span></a></div><div class="card-widget card-announcement"><div class="item-headline"><i class="fas fa-bullhorn card-announcement-animation"></i><span>公告</span></div><div class="announcement_content">This is my Blog</div></div><div class="sticky_layout"><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/2023/11/06/2023%E8%93%9D%E5%B8%BD%E6%9D%AF%E5%86%B3%E8%B5%9BWP/" title="2023蓝帽杯决赛WP"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/20231106163334.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="2023蓝帽杯决赛WP"/></a><div class="content"><a class="title" href="/2023/11/06/2023%E8%93%9D%E5%B8%BD%E6%9D%AF%E5%86%B3%E8%B5%9BWP/" title="2023蓝帽杯决赛WP">2023蓝帽杯决赛WP</a><time datetime="2023-11-06T08:31:51.000Z" title="发表于 2023-11-06 16:31:51">2023-11-06</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/10/20/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8CRE/" title="攻防世界RE"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/c78ed35b1e3999643d52a652257558af0a15b4c9_raw.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="攻防世界RE"/></a><div class="content"><a class="title" href="/2023/10/20/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8CRE/" title="攻防世界RE">攻防世界RE</a><time datetime="2023-10-20T12:38:32.000Z" title="发表于 2023-10-20 20:38:32">2023-10-20</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/09/22/%E5%AE%89%E5%8D%93%E5%B8%B8%E7%94%A8%E7%9B%AE%E5%BD%95/" title="安卓常用目录"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/mmexport1694863328916.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="安卓常用目录"/></a><div class="content"><a class="title" href="/2023/09/22/%E5%AE%89%E5%8D%93%E5%B8%B8%E7%94%A8%E7%9B%AE%E5%BD%95/" title="安卓常用目录">安卓常用目录</a><time datetime="2023-09-22T01:27:02.000Z" title="发表于 2023-09-22 09:27:02">2023-09-22</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/09/22/010Editor%E7%A0%B4%E8%A7%A3/" title="010Editor破解"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/1694867487605.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="010Editor破解"/></a><div class="content"><a class="title" href="/2023/09/22/010Editor%E7%A0%B4%E8%A7%A3/" title="010Editor破解">010Editor破解</a><time datetime="2023-09-22T00:33:10.000Z" title="发表于 2023-09-22 08:33:10">2023-09-22</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2023/08/24/%E6%9F%90APP%E7%9A%84%E9%80%86%E5%90%91%E5%88%86%E6%9E%90/" title="某APP的逆向分析"><img src="https://xyhutc.oss-cn-qingdao.aliyuncs.com/giteetuchuang/a4c8982faff8839d06cc010c864e02e8092efb23_raw.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="某APP的逆向分析"/></a><div class="content"><a class="title" href="/2023/08/24/%E6%9F%90APP%E7%9A%84%E9%80%86%E5%90%91%E5%88%86%E6%9E%90/" title="某APP的逆向分析">某APP的逆向分析</a><time datetime="2023-08-24T14:02:11.000Z" title="发表于 2023-08-24 22:02:11">2023-08-24</time></div></div></div></div><div class="card-widget card-archives"><div class="item-headline"><i class="fas fa-archive"></i><span>归档</span><a class="card-more-btn" href="/archives/" title="查看更多">
    <i class="fas fa-angle-right"></i></a></div><ul class="card-archive-list"><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/11/"><span class="card-archive-list-date">十一月 2023</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/10/"><span class="card-archive-list-date">十月 2023</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/09/"><span class="card-archive-list-date">九月 2023</span><span class="card-archive-list-count">2</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/08/"><span class="card-archive-list-date">八月 2023</span><span class="card-archive-list-count">2</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/07/"><span class="card-archive-list-date">七月 2023</span><span class="card-archive-list-count">1</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/04/"><span class="card-archive-list-date">四月 2023</span><span class="card-archive-list-count">4</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/03/"><span class="card-archive-list-date">三月 2023</span><span class="card-archive-list-count">4</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2023/01/"><span class="card-archive-list-date">一月 2023</span><span class="card-archive-list-count">2</span></a></li></ul></div><div class="card-widget card-webinfo"><div class="item-headline"><i class="fas fa-chart-line"></i><span>网站资讯</span></div><div class="webinfo"><div class="webinfo-item"><div class="item-name">文章数目 :</div><div class="item-count">66</div></div><div class="webinfo-item"><div class="item-name">本站总字数 :</div><div class="item-count">97.2k</div></div><div class="webinfo-item"><div class="item-name">本站访客数 :</div><div class="item-count" id="busuanzi_value_site_uv"></div></div><div class="webinfo-item"><div class="item-name">本站总访问量 :</div><div class="item-count" id="busuanzi_value_site_pv"></div></div><div class="webinfo-item"><div class="item-name">最后更新时间 :</div><div class="item-count" id="last-push-date" data-lastPushDate="2024-01-18T02:16:30.069Z"></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2024 By 惜缘怀古</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><div class="js-pjax"></div><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div></body></html>